Known vulnerabilities in YARPP – Yet Another Related Posts Plugin

The best WordPress plugin for displaying related posts. Simple and flexible, with a powerful proven algorithm and inbuilt caching.

8Reported vulnerabilities

9.8Highest CVSS score

5.30.11Latest version

100,000+Active installs

What to do now

Update YARPP – Yet Another Related Posts Plugin to 5.30.11 or later. 8 of these have a fixed version available. Updating resolves them.

Plugin last updated: November 11, 2024 / Tested up to WordPress: 6.7.7 / View on wordpress.org

Reported vulnerabilities

Ordered by how urgently they need attention — whether a vulnerability is actually being exploited, and how likely exploitation is, rather than CVSS severity alone.

CVE	Severity	Exploit probability next 30 days	Affected versions	Fixed in	Published
CVE-2024-43919	Medium 5.3	44.5%	5.30.10 and earlier	`5.30.11`	August 26, 2024
CVE-2023-0579	High 8.8	0.9%	Before 5.30.3	`5.30.3`	August 16, 2023
WF-78759abf-4584-4beb-9ae7-39a5c3fe4b75	Critical 9.8	—	Before 4.2.5	`4.2.5`	May 8, 2015
CVE-2022-4471	Medium 5.4	0.7%	5.30.1 and earlier	`5.30.3`	February 13, 2023
CVE-2022-45374	High 8.8	0.8%	5.30.4 and earlier	`5.30.5`	April 18, 2023
CVE-2024-0602	Medium 4	0.5%	Before 5.30.10	`5.30.10`	February 29, 2024
CVE-2023-2433	Medium 5.4	0.5%	5.30.3 and earlier	`5.30.4`	July 18, 2023
CVE-2023-6495	Medium 4.8	0.3%	Before 5.30.10	`5.30.10`	June 19, 2024

Sources: vulnerability records from NVD, exploitation from CISA KEV, exploit probability from EPSS. Affected versions come from CPE ranges or from the reporting CNA.